Go to main page
Versions in this module
v1
Nov 6, 2026
Oct 30, 2026
Oct 27, 2026
Oct 26, 2026
Oct 23, 2026
Oct 23, 2026
Oct 23, 2026
Aug 6, 2026
Jul 12, 2026
May 12, 2026
May 5, 2026 GO-2026-5008
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
May 4, 2026 GO-2026-5008
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
Apr 30, 2026 GO-2026-5008 +2 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
Apr 29, 2026 GO-2026-5008 +3 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
Apr 29, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 28, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 27, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 27, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 25, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 15, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Mar 6, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Feb 10, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Dec 13, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Nov 18, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Nov 17, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Nov 3, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 29, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 29, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 24, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 24, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 16, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 16, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 15, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 14, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry